You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2019/04/06 12:58:32 UTC
[httpcomponents-core] branch HTTPCLIENT-1981 updated:
HTTPCLIENT-1981: disallow TRACE requests with an enclosed entity
This is an automated email from the ASF dual-hosted git repository.
olegk pushed a commit to branch HTTPCLIENT-1981
in repository https://gitbox.apache.org/repos/asf/httpcomponents-core.git
The following commit(s) were added to refs/heads/HTTPCLIENT-1981 by this push:
new cf7ef3a HTTPCLIENT-1981: disallow TRACE requests with an enclosed entity
cf7ef3a is described below
commit cf7ef3a6a0a84615bf617d02ed5f19e297956496
Author: Oleg Kalnichevski <ol...@apache.org>
AuthorDate: Sat Apr 6 14:58:19 2019 +0200
HTTPCLIENT-1981: disallow TRACE requests with an enclosed entity
---
.../org/apache/hc/core5/http2/protocol/H2RequestConnControl.java | 7 +++++++
.../org/apache/hc/core5/http/protocol/RequestConnControl.java | 5 ++++-
.../apache/hc/core5/http/protocol/TestStandardInterceptors.java | 9 +++++++++
3 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/protocol/H2RequestConnControl.java b/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/protocol/H2RequestConnControl.java
index 838f76b..e397a63 100644
--- a/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/protocol/H2RequestConnControl.java
+++ b/httpcore5-h2/src/main/java/org/apache/hc/core5/http2/protocol/H2RequestConnControl.java
@@ -34,6 +34,8 @@ import org.apache.hc.core5.annotation.ThreadingBehavior;
import org.apache.hc.core5.http.EntityDetails;
import org.apache.hc.core5.http.HttpException;
import org.apache.hc.core5.http.HttpRequest;
+import org.apache.hc.core5.http.Methods;
+import org.apache.hc.core5.http.ProtocolException;
import org.apache.hc.core5.http.ProtocolVersion;
import org.apache.hc.core5.http.protocol.HttpContext;
import org.apache.hc.core5.http.protocol.RequestConnControl;
@@ -56,6 +58,11 @@ public class H2RequestConnControl extends RequestConnControl {
final ProtocolVersion ver = context.getProtocolVersion();
if (ver.getMajor() < 2) {
super.process(request, entity, context);
+ } else {
+ final String method = request.getMethod();
+ if (Methods.TRACE.isSame(method) && entity != null) {
+ throw new ProtocolException("TRACE request may not enclose an entity");
+ }
}
}
diff --git a/httpcore5/src/main/java/org/apache/hc/core5/http/protocol/RequestConnControl.java b/httpcore5/src/main/java/org/apache/hc/core5/http/protocol/RequestConnControl.java
index 5340f55..63896df 100644
--- a/httpcore5/src/main/java/org/apache/hc/core5/http/protocol/RequestConnControl.java
+++ b/httpcore5/src/main/java/org/apache/hc/core5/http/protocol/RequestConnControl.java
@@ -38,6 +38,7 @@ import org.apache.hc.core5.http.HttpHeaders;
import org.apache.hc.core5.http.HttpRequest;
import org.apache.hc.core5.http.HttpRequestInterceptor;
import org.apache.hc.core5.http.Methods;
+import org.apache.hc.core5.http.ProtocolException;
import org.apache.hc.core5.util.Args;
/**
@@ -64,7 +65,9 @@ public class RequestConnControl implements HttpRequestInterceptor {
if (Methods.CONNECT.isSame(method)) {
return;
}
-
+ if (Methods.TRACE.isSame(method) && entity != null) {
+ throw new ProtocolException("TRACE request may not enclose an entity");
+ }
if (!request.containsHeader(HttpHeaders.CONNECTION)) {
// Default policy is to keep connection alive
// whenever possible
diff --git a/httpcore5/src/test/java/org/apache/hc/core5/http/protocol/TestStandardInterceptors.java b/httpcore5/src/test/java/org/apache/hc/core5/http/protocol/TestStandardInterceptors.java
index d44f003..634630a 100644
--- a/httpcore5/src/test/java/org/apache/hc/core5/http/protocol/TestStandardInterceptors.java
+++ b/httpcore5/src/test/java/org/apache/hc/core5/http/protocol/TestStandardInterceptors.java
@@ -98,6 +98,15 @@ public class TestStandardInterceptors {
Assert.assertEquals("upgrade", header.getValue());
}
+ @Test(expected = ProtocolException.class)
+ public void testRequestConnControlTraceWithEntity() throws Exception {
+ final HttpContext context = new BasicHttpContext(null);
+ final BasicClassicHttpRequest request = new BasicClassicHttpRequest(Methods.TRACE, "/");
+ request.setEntity(new StringEntity("stuff"));
+ final RequestConnControl interceptor = new RequestConnControl();
+ interceptor.process(request, request.getEntity(), context);
+ }
+
@Test
public void testRequestConnControlInvalidInput() throws Exception {
final RequestConnControl interceptor = new RequestConnControl();